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IN THE CLAIMS 

The following is a listing of the claims of the present application: 

1. (Currently Amended) Apparatus for providing decision support to an analyst in 
accordance with an event management system which manages a network with one or more 
computing devices, the apparatus comprising: 

at least one processor operative to perform: (i) an automated off-line analysis of data 
representing past events associated with the network of computing devices being managed by the 
event management system, the automated analysis comprising generation of one or more 
visualizations of one or more portions of the past event data and discovery of one or more patterns 
in the past event data; and (ii) automated rule off-line management comprising construction and 
validation of one or more rules formed in accordance with the automated off-line analysis of the past 
event data , wherein one or more rules are constructed offline and validated offline based directlv on 
at least a portion of the one or more visualizations generated offline from the corresponding offline 
analvsis of the one or more portions of the past event data and the offline discovery of at least a 
portion of the one or more patterns in the past event data : and 

memory, coupled to the at least one processor, which stores at least a portion of results 
associated with the automated off-line event analysis and off-line rule management operations. 

2. (Original) The apparatus of claim 1 , wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

3. (Original) The apparatus of claim 2, wherein generation of the one or more visualizations 
of the one or more portions of the past event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings of 
events that are of interest presented therein; and 

performing an appropriate action when an event grouping of interest is found. 
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4. (Original) The apparatus of claim 2, wherein discovery of the one or more patterns in the 
past event data further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of interest 
presented therein; and 

performing an appropriate action when a pattern of interest is found. 

5. (Original) The apparatus of claim 2, wherein validation of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of rules; 

generating a visualization of the one or more pattern instances using a visualization tool; 

analyzing the left-hand sides of rules using a rule validation tool; 

displaying results of the analysis operation; 

the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by the 

analyst. 

6. (Original) The apparatus of claim 2, wherein construction of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

assessing significance of the one or more patterns using a visualization tool; 



3 



Attorney Docket No. YOR920010746US1 

constructing the one or more rules from a selected subset of the one or more patterns using 
a rule construction tool; and 

writing the one or more rules in the rule database. 

7. (Currently Amended) A computer-based method of providing decision support to an 
analyst in accordance with an event management system which manages a network with one or more 
computing devices, the method comprising the steps of: 

automatically analyzing, off-line, data representing past events associated with the network 
of computing devices being managed by the event management system, the automated off-line 
analysis comprising generation of one or more visualizations of one or more portions of the past 
event data and discovery of one or more pattems in the past event data; and 

automatically managing rules off-line, the automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data , wherein one or more rules are constructed offline and validated 
offline based directlv on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analvsis of the one or more portions of the past event data and the offline 
discover/ of at least a portion of the one or more pattems in the past event data . 

8. (Original) The method of claim 7, wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

9. (Original) The method of claim 7, wherein generation of the one or more visualizations 
of the one or more portions of the past event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings of 
events that are of interest presented therein; and 

performing an appropriate action when an event grouping of interest is found. 
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10. (Original) The method of claim 7, wherein discovery of the one or more patterns in the 
past event data further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of interest 
presented therein; and 

performing an appropriate action when a pattern of interest is found. 

1 1 . (Original) The method of claim 7, wherein validation of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of rules; 

generating a visualization of the one or more pattern instances using a visualization tool; 

analyzing the left-hand sides of rules using a rule validation tool; 

displaying results of the analysis operation; 

the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by the 
analyst. 

12. (Original) The method of claim 7, wherein construction of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

assessing significance of the one or more patterns using a visualization tool; 
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constructing the one or more rules from a selected subset of the one or more patterns using 
a rule construction tool; and 

writing the one or more rules in the rule database. 

13. (Currently Amended) An article of manufacture for providing decision support to an 
analyst in accordance with an event management system which manages a network with one or more 
computing devices, the article comprising a machine readable medium containing one or more 
programs which when executed implement the steps of: 

automatically analyzing data, off-line, representing past events associated with the network 
of computing devices being managed by the event management system, the automated off-line 
analysis comprising generation of one or more visualizations of one or more portions of the past 
event data and discovery of one or more patterns in the past event data; and 

automatically managing rules off-line, the automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data , wherein one or more rules are constructed offline and validated 
offline based directlv on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analvsis of the one or more portions of the past event data and the offline 
discoverv of at least a portion of the one or more patterns in the past event data . 

14. (Original) The article of claim 13, wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

15. (Currently Amended) Apparatus for providing decision support to an analyst in 
accordance with an event management system which manages a network with one or more 
computing devices, the apparatus comprising: 

first processing means for performing an automated off-line analysis of data representing past 
events associated with the network of computing devices being managed by the event management 
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system, the automated off-line analysis comprising generation of one or more visualizations of one 
or more portions of the past event data and discovery of one or more patterns in the past event data; 

second processing means for performing automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data , wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data : and 

memory means, coupled to the first and second processing means, for storing at least a 
portion of results associated with the automated off-line event analysis and off-line rule management 
operations. 

16. (Original) The apparatus of claim 15, wherein the past event data is obtained from an 
event database and the one or more rules are provided to a rule database, the event database and the 
rule database being associated with an execution system of the event management system. 

17. (Currently Amended) An event management decision support system for providing 
decision support to an analyst in accordance with an event management system which manages a 
network with one or more computing devices, the system comprising: 

one or more data analysis tools for automatically analyzing, in an off-line condition, data 
representing events associated with the network of computing devices being managed by the event 
management system, the automated analysis comprising generation of one or more visualizations 
of one or more portions of the event data and discovery of one or more patterns in the event data; 
and one or more rule management tools for automatically managing rules in an off-line condition, 
the automated rule management comprising construction and validation of one or more rules formed 
in accordance with the automated analysis of the event data , wherein one or more rules are 
constructed offline and validated offline based direcflv on at least a portion of the one or more 
visualizations generated offline from the corresponding offline analysis of the one or more portions 
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of the event data and the offline discovery of at least a portion of the one or more patterns in the 
event data . 

18. (Original) The system of claim 17, wherein the event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 
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